MITRE D3FENDdefensive technique

D3-FRDDL Forward Resolution Domain Denylisting

Official page ↗
Tactic
Isolate
Synonyms
Forward Resolution Domain Blacklisting

Definition

Blocking a lookup based on the query's domain name value.

How it works

How it works Policies are created that filter DNS queries using fully qualified domain name (FQDN) of record in the query. A DNS policy can be created for blocking DNS queries from FQDNs that have been identified as unauthorized. Considerations Continuous maintenance of unauthorized domain lists is needed to keep up to date as updates occur.

Related

Counters · MITRE ATT&CK (3)

  • T1071.004 DNS sub-technique
  • T1568 Dynamic Resolution technique
  • T1071 Application Layer Protocol technique

Child of · MITRE D3FEND (1)

  • D3-DNSDL DNS Denylisting defensive technique

Referenced by MITRE D3FEND · child of (2)

  • D3-HDDL Hierarchical Domain Denylisting defensive technique
  • D3-HDL Homoglyph Denylisting defensive technique

References